Supported Targets
Last updated
The standard pentest workflow targets REST and GraphQL APIs. Server-side rendered HTML applications and single-page applications are evaluated by the Bug Hunt workflow rather than the standard pentest.
REST APIs
Yes
Full support with or without OpenAPI definitions.
GraphQL APIs
Yes
Introspection, mutation testing, authorization matrix analysis.
SSR HTML Apps
Bug Hunt only / beta
Server-side rendered web apps (Django, Rails, Express, etc.) are assessed by the Bug Hunt workflow, not the standard pentest workflow.
SPAs
Bug Hunt only / beta
Single-page apps (React, Vue, Angular) are assessed by the Bug Hunt workflow, not the standard pentest workflow.
SOAP APIs
Not yet
Register interest with the Nullify team.
WebSockets
Not yet
Event-driven assessments are on the roadmap.
gRPC
Not yet
Reach out if you would like to participate in design partners.
Custom TCP/UDP Protocols
Not yet
Custom protocol testing on the roadmap.
Last updated